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REMARKS 

Claims 1-7 and 10-16 are currently pending in the present application. 

Reicctjon under 35 U.S.C. 5 103 

Claims 1-7 and 10-16 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Win et al. (US 6,161,139) in view of Shrader et al (US 6.374,359). Applicants respectfully 
traverse such rejection. 

For a procedural standpoint. Claims 1-7 and 10-16 were rejected under 35 U.S.C. § 103(a) 
as being unpatentable over Win et al (US 6.182,142) in view of Shrader et al (US 6,374,359) 
in a previous non-fmal Office Action dated February 27, 2004. Applicants responded to the non- 
jSnal Office Action without amending any claims. Since the Examiner introduced a new ground 
of rejection ((.e., by citing a new prior art reference Winetal (US 6.161,139)). the current Final 
Office Action is considered as premature under MPEP § 706.07(a). 

On merits, Claim 1 (and similarly Claim 10) recites a step of "storing a encryption key 
pair having a private key and a public key in a protected storage device within said data 
processing system" and a step of "in response to the receipt of a cookie generated by an 
i^lication from a remote server, encrypting said cookie with said public key." Thus, according 
to the claimed invention, in response to the receipt of a cookie originated from a remote server, 
a data processing system encrypts the cookie with a public key previously stored within the data 
processing system. Basically, the cookie encryption of the present invention is performed at the 
data processing system of a user (or client). 

On page % of the Final Office Action, the Examiner states that Win teaches that "the 
Autiientication Client Module reads the user's roles from the Registry Server 108. It then 
encrypts and sends this information in a "cookie" to the user's browser." Applicants agree with 
the Examiner that Win teaches the cookie being encrypted in Registry Server 108. Since it is 
clear from Figure 1 of Win that Registry Server 108 is part of a secure intranet (col. 4, lines 33- 
34) and not part of the user's browser or the user's data processing system. Win does not teach 
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or suggest the cookie encryptioa being performed at the data processing system of a user, as 
claimed. Shrader does not teach or suggest the cookie enciyption being performed at the data 



not found in the cited references, whether considered separately or in combination, the § 103 
rejection is believed to be overcome. 



Claims 1-7 and 10-16 are currently pending in the present application. For the reasons 
stated above. Applicants beUeve that independent Ckims 1 and 10 along with their respective 
dependent claims are in condition for allowance. The remaining prior art cited by the Examiner 
but not relied upon has been reviewed and is not believed to show or suggest the claimed 
invention. 

No fee or extension of time is beheved to be necessary; however, in the event that any 
fee or extension of time is required for the prosecution of this application, please charge it against 
Deposit Account No. 50-0563, 



processing system of a user dther. Because the claimed invention recites novel features that are 



CONCLUSION 
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